On February 15, 1995 the FBI managed to hunt down Kevin Mitnick, considered by the New York Times as "the most wanted hacker in all cyberspace." Mitnick would end up spending five years in prison for various crimes, including eight months in an isolation cell.
Why so much time in isolation? Because someone convinced the judge that he was capable of "initiating a nuclear war by whistling on a public telephone". That decision increased the myth of a hacker who achieved much more for his ability with social engineering than for his technical ability.
A ghost in the wires
Mitnick has written four books to date, although the most biographical of them all is ' A Ghost in the Wires ' (2011, Captain Swing). It is in this volume of almost 500 pages that the hacker - with the help of the writer William L. Simon - tells his whole story, from when he started in this area until he was arrested by the FBI and then tried and imprisoned.
Mitnick1
Mitnick soon discovered to take advantage of the weaknesses of the systems he used in his day to day. It all started with the bus tickets he used to get around Los Angeles, and that they had a particular way of being bored according to the day, time or route of each bus.
The young Mitnick managed to find out where to buy the machine with which these cards were punched, he got a lot of cards prepared to be punched in a terminal where the drivers left their card books unattended, and that's how he ended up traveling from one place to another. side by side of the city without paying . No one stopped her feet then, as she states in the book:
It seemed ingenious to my mother, it seemed to my father a show of initiative, and the bus drivers who knew that I was stinging my own transshipment tickets seemed a very funny thing to them. It was as if all the people who knew what I was doing were patting me on the back.
The magician of social engineering
Maybe that first adventure with a prize (and without punishment) ended up defining his later activity, which would soon end up focusing on social engineering , a practice with which he managed to obtain information from all kinds of systems by manipulating legitimate users of those systems. The current phishing attacks are an alternative way to use this technique.
Engineering
The basic technique was (and is) as efficient as it is simple , and Mitnick constantly repeated it. In one of his first social engineering attacks he explained how he needed an applicant number to "click" the Department of Motor Vehicles (DMV). To achieve this he called a police station and pretended to be someone from the DMV. There he asked the interlocutor: "Is your applicant code 36472?", To which the agent replied: "No, it's 62883." Mitnick emphasized how well that worked:
It is a trick that I have discovered that works very often. If you ask for confidential information, people naturally suspect immediately. If you pretend that you already have that information and say something that is wrong, people usually correct you and reward you with the information you were looking for.
This basic principle of social engineering was linked to another essential one: people tend to be the weakest link in a chain of security, because "people always want to help" .
In the book it is clear how the combination of both techniques gave Mitnick amazing results. In all those attacks of social engineering there was a third component, of course: this hacker had to know in quite detail the information environment he was looking for : format of the codes he needed, telephone prefixes, names and positions of the employees, or bureaucratic operation of those processes to get certain documents, for example.
All this information allowed Mitnick to deal with those phone calls with the certainty of being able to get the desired answer, even though at the other end of the communication there was someone who suspected whether the person asking for the information was doing it legitimately. Mitnick had a natural ability to lie and cheat his victims - he was very active in reinforcing it - even when they posed additional questions to prove his identity.
That allowed him to combine those techniques of social engineering with real exploits in the systems to which he got access to get what he wanted. One of the first examples we have in its intrusion into a system called 'The Ark' that the company Digital Equipment Corporation (DEC) used to develop its operating system RSTS / E.
Ghost
Mitnick had the phone number that gave access to the system, but he had no username and password, so he pretended to be one of the RSTS / E developers to ask an administrator to reset the password with the excuse that he did not He could authenticate himself in the one he always used.
In five minutes he had gained access to the system taking advantage of these techniques, and later would use similar processes to then leave small Trojans with which he collected passwords from other users or left back doors with which to access these systems later without being discovered.
His technical knowledge may not have been as striking as his ability with social engineering, but throughout the book Mitnick refers to intrusions in which social engineering was only part of the process. Román Ramírez, expert in cybersecurity and organizer of the Rooted CON conference, confirmed how, for example, Minick "was very good and used a very powerful TCP session hijacking technique that was difficult to perform at that time". That attack, with which he accessed, for example, Tsutomu Shimomura's computer, was later known as ' The Mitnick attack '.
Much of its activity in the early years, however, focused on telephone networks : Mitnick made use of social engineering researching the jargon and system infrastructure to get codes and secret numbers that allowed him to make wiretaps, access to numbers that were not in the directory or making long distance calls.
At one point he came to have exceptional control of the Pacific Bell network, and even ended up listening to the FBI agents who were investigating the case and trying to arrest him. In the book, for example, he explains how he set up a system that allowed him to alert him when a raid was going to be organized so he could escape in time, and on one of the occasions he ended up playing a joke on the agents and leaving them donuts .
His skills also extended to other areas such as identity theft , a process that he also managed to control in order to have several alternative identities that he could use during his escape.
The process to achieve it was relatively simple, and at the time there was a well-known book by Barry Raid entitled "The Paper Trip" that explained the whole process in detail and from which three additional volumes would appear. Achieving it today , explained Mitnick in DEFCON 2014 , is equally possible.
Hero and villain in equal parts
During his pursuit, capture and subsequent conviction , the figure of Kevin Mitnick transcended to become the benchmark of a segment that was then still in its infancy and that we had only known through films like the famous' War Games ' (Wargames'). , John Badham, 1983). As the hacker himself explained ,
Despite the myth created by the media, I am not a malicious hacker. What I did was not even illegal when I started, but it became a crime when new laws were passed. I kept doing it and I was captured. The way the Federal Government treated me was not based on my crimes, but on becoming an example.
During much of the time spent in prison, the leaders and followers of the famous magazine '2600: The Hacker Quaterly' organized a campaign called 'FREE KEVIN' in which they tried to get the United States justice to release Mitnick. That campaign was the counterpoint to the image of villain that John Markoff, journalist of The New York Times, had given of Mitnick in a famous article of July 4, 1994.
In that article Markoff described Kevin Mitnick as "the most wanted of cyberspace" and attributed crimes such as those of having accessed NORAD (North American Air Defense Command), something that the hacker claimed was impossible if we consider that their systems They were isolated from the internet.
Many - starting with Mitnick - criticized that information, claiming that it was based on rumors and government claims that had never been proven.
Those responsible for '2600' ended up producing a documentary called 'Freedom Downtime' - available entirely on YouTube - which told all the facts and included interviews with hacker Kevin Poulsen or John Markoff himself.
Markoff collaborated in the pursuit of the FBI Mitnick with Tsutomu Shimomura, who at that time worked at the University of California in San Diego. Some time ago Mitnick had infiltrated that institution, and also accessed the post of John Markoff, who analyzed to find out if there were clues that would help him to avoid the FBI .
Markoff and Shimomura would end up writing their own version of events in their novel 'Takedown' (1996, Hyperion ), which was even taken to the movies.
Mitnick's book not only narrates the "adventures of the most wanted hacker in the world", but also does so trying to defend that at all times he did not take advantage of all those intrusions for his own benefit . In an interview in the year 2000 in El Mundo Mitcnick explains how
I was never able to steal money. And today I could be a multi-millionaire and live the rest of my days in the Caribbean sun. But the conscience prevented me. What impelled me to do what I was doing was the euphoria of scientific discovery, the pleasure that is experienced when a difficult mathematical problem is solved.
These statements could contrast with facts that Mitnick himself narrates in his book and in which he stole code from operating systems such as Solaris or Motorola phones. But as he explains, getting that code was a way to " understand how those phones worked , how the codes controlled the processor". Even so, he recognizes that this was a mistake:
I was not interested in selling the source code or doing an ago with it. It was above all the challenge of achieving that code. I'm not particularly proud of it because obviously it was not right. I made a stupid decision and decided to go after that code.
From hacker to lecturer and security consultant
After his release from prison in January 2000, Mitnick was banned from a computer or even a mobile phone for the next three years . He appealed that decision and obtained a ruling in his favor to be able to use those devices, but he had to agree not to obtain economic benefits from films or books based on his activity for 7 years.
Card
The business card of Kevin Mitnick, who has a series of picks, has become a celebrity by itself.
In December 2002 Mitnick was considered "sufficiently rehabilitated" and he was granted a license for amateur radio, and later he would end up founding Mitcnick Security Consulting LLC , a computer security company in which he is basically engaged in what he was doing before being arrested, but with the express permission of the companies that hire him to analyze his security.
Mitnick gives lectures all over the world and has become a public figure also on social networks like Twitter . In addition to the company that bears his name, he is the Chief Hacking Officer of KnowBe4 , another IT security consulting and training company.
This great article and more very interesting information can be found at the source.
Source: Xataka
